Cross-Account EFS Access for Lambda via VPC Peering

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Create a VPC peering connection between the VPCs to allow the primary account's Lambda function to access the secondary account's EFS file system directly.

Question

A company needs to create an AWS Lambda function that will run in a VPC in the company's primary AWS account. The Lambda function needs to access files that the company stores in an Amazon Elastic File System (Amazon EFS) file system. The EFS file system is located in a secondary AWS account. As the company adds files to the file system, the solution must scale to meet the demand. Which solution will meet these requirements MOST cost-effectively?
  1. Create a new EFS file system in the primary account. Use AWS DataSync to copy the contents of the original EFS file system to the new EFS file system.
  2. Create a VPC peering connection between the VPCs that are in the primary account and the secondary account. Correct Answer
  3. Create a second Lambda function in the secondary account that has a mount that is configured for the file system. Use the primary account's Lambda function to invoke the secondary account's Lambda function.
  4. Move the contents of the file system to a Lambda layer. Configure the Lambda layer's permissions to allow the company's secondary account to use the Lambda layer.

Key Takeaways

The core concept tested is cross-account resource access; the common trap is choosing data duplication (DataSync) or architectural complexity (secondary Lambda) when simple networking suffices.

This question examines the most cost-effective method for a Lambda function in one AWS account to access an Amazon EFS file system located in another AWS account. The correct solution leverages VPC peering to enable secure, direct network connectivity without duplicating data or adding complex orchestration.

Common mistake: Candidates often select Option A (AWS DataSync) because they overestimate the need for data redundancy or underestimate the simplicity of VPC peering, leading to unnecessary storage costs and operational overhead.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because AWS supports mounting Amazon EFS file systems from a different AWS account into a Lambda function's execution environment, provided the necessary network connectivity exists. VPC peering is the standard, low-cost mechanism to connect VPCs across accounts, allowing the primary account's Lambda to reach the secondary account's EFS mount target securely. This approach incurs only the minimal cost of VPC peering traffic (if any, depending on region/account setup) and avoids data transfer fees associated with copying data.

Why the Other Options Are Wrong

Option A is incorrect because creating a duplicate EFS file system using AWS DataSync introduces significant storage costs and maintenance complexity, violating the 'MOST cost-effectively' requirement. Option C adds unnecessary architectural complexity by invoking a second Lambda function, which increases latency and operational overhead compared to direct file system access. Option D is technically invalid as Lambda layers are limited to 250 MB and are designed for code libraries, not large-scale file storage like EFS.

Community Comment Notes

Community consensus strongly favors Option B, with users highlighting that VPC peering provides seamless, secure access without manual scaling efforts. One commenter noted that duplicating the file system leads to 'unnecessary storage costs,' while others pointed out that Lambda layers are unsuitable for this use case due to size constraints and purpose. Comments referenced official AWS documentation confirming that cross-account EFS access requires VPC peering.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked for the 'most cost-effective' solution involving cross-account resources, prioritize native networking features like VPC peering over data replication or additional compute services unless specific performance or isolation requirements dictate otherwise.

Frequently Asked Questions

Why isn't AWS DataSync the best choice here?

DataSync duplicates data, incurring extra storage costs and sync complexity. VPC peering allows direct access to the single source of truth, which is more cost-effective.

Can Lambda access EFS in another account without VPC peering?

No. Cross-account access to EFS from Lambda requires network connectivity, typically established via VPC peering, Transit Gateway, or AWS PrivateLink.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. lenotc 👍 8 Answered B
    B -> VPC peering allows the Lambda access secondary account securely and efficiently A -> redundancy C -> additional complexity D -> sharing code libraries
  2. osmk 👍 3 Answered B
    https://docs.aws.amazon.com/efs/latest/ug/efs-different-vpc.html
  3. LeonSauveterre 👍 1 Answered B
    A - Duplicating the EFS file system leads to unnecessary storage costs and additional complexity. B - VPC peering connection allows seamless access without additional manual scaling. C - Well... I don't know, but you could've directly enabled access to the EFS file system. Why make it even more complex? D - Lambda layers are intended for shared libraries or dependencies. You would be crazy to store large amounts of data there.
  4. Scheldon 👍 1 Answered B
    AnswerB You can configure a function to mount an Amazon EFS file system in another AWS account. Before you mount the file system, you must ensure the following: VPC peering must be configured, and appropriate routes must be added to the route tables in each VPC. . . . https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem-cross-account.html
  5. Nm55569 👍 1 Answered B
    https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem.html#configuration-filesystem-cross-account
Show 1 more comment
  1. asdfcdsxdfc 👍 1
    Shouldn't it be B?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide